# Technical documentation — interview-code

Evidence date: 2026-10-12.

Source: `git@bitbucket.org:overdrive/interview-code.git`, `master` at `cc4eee7` (2020-10-29, Jaco Brits, "add server and upload script"). Only branch: `master`. `origin/HEAD` points at `master`.

No secrets are committed. `server/server.js` hard-codes the listen port and the CORS origin. Those values are configuration, not credentials.

## Architecture

Two independent Node projects in one git repository.

1. **React client** at the repository root. Create React App, `react-scripts` 4.0.0. Entry `src/index.js` mounts `src/App.js` on `#root`. The page is the generator sample. It does not call the server.
2. **HTTP server** in `server/`. Express 4 creates the app, `cors` wraps it, and `server/upload.js` is the sole route handler. Formidable parses the body. Nothing is persisted.

There is no shared package, no monorepo tool, no reverse proxy config, and no `proxy` field in the root `package.json`.

```text
Browser
  └── react-scripts (root package.json "start")
        └── src/App.js sample page

HTTP client
  └── Express listen 8000 (server/server.js)
        └── POST /upload → formidable IncomingForm (server/upload.js)
              └── file event: no write
              └── end event: res.json() with no argument
```

## Repository layout

```text
.gitignore                 sample ignore list (node_modules, dist, Java/Python/Maven, IDE, media)
README.md                  technical-review brief
package.json               React package, name "code"
yarn.lock                  lock for the React package
public/                    index.html, manifest, robots.txt, favicon, logo192, logo512
src/                       App.js, App.css, App.test.js, index.js, index.css,
                           logo.svg, reportWebVitals.js, setupTests.js
server/package.json        Express package, name "server"
server/package-lock.json   npm lock, lockfileVersion 1
server/yarn.lock           second lock for the same package.json
server/server.js           listen and route
server/upload.js           Formidable handler
server/.gitignore          node_modules
```

Not in git at `cc4eee7`: root `package-lock.json`, `server/index.js`, `.env`, Dockerfile, `bitbucket-pipelines.yml`, tests under `server/`, `sonar-project.properties`, `sonarqube_scan.bat`.

The OVER-164 task text listed `sonar-project.properties` and `sonarqube_scan.bat` on the scan host, and a path that rendered as `src\nyarn.lock`. Tracked Yarn locks are `yarn.lock` and `server/yarn.lock`. **Unknown / Requires Confirmation** whether the Sonar files were local-only.

## Languages and libraries

JavaScript only. No TypeScript config.

| Piece | Declared | Locked | Used by |
|---|---|---|---|
| React | `^17.0.1` | `17.0.1` (root `yarn.lock`) | `src/index.js`, `src/App.js` |
| ReactDOM | `^17.0.1` | `17.0.1` | `ReactDOM.render` in `src/index.js` |
| react-scripts | `4.0.0` exact | `4.0.0` | `start`, `build`, `test`, `eject` |
| @material-ui/core | `^4.11.0` | `4.11.0` | No import |
| web-vitals | `^0.2.4` | `0.2.4` | Dynamic import inside `reportWebVitals` when a function is passed. The call site passes none |
| @testing-library/react | `^11.1.0` | root `yarn.lock` (not restated; range is the declaration) | `src/App.test.js` |
| @testing-library/jest-dom | `^5.11.4` | root `yarn.lock` | `src/setupTests.js` |
| @testing-library/user-event | `^12.1.10` | root `yarn.lock` | Declared. No test imports it |
| express | `^4.17.1` in `server/package.json` | npm lock `4.17.1`. Yarn lock resolves `express@^4.16.4` to `4.16.4` | `server/server.js` |
| cors | `^2.8.5` | `2.8.5` in both server locks | `server/server.js` |
| formidable | `^1.2.2` in `server/package.json` | npm lock `1.2.2`. Yarn lock resolves `formidable@^1.2.1` to `1.2.1` | `server/upload.js` |

The server Yarn lock's dependency keys (`express@^4.16.4`, `formidable@^1.2.1`) do not match the ranges now in `server/package.json` (`^4.17.1`, `^1.2.2`). Both lockfiles were added in the same commit, `cc4eee7`. Which file an installer should use is **Unknown / Requires Confirmation**. `npm ci` inside `server/` would follow `package-lock.json`. `yarn` would follow `server/yarn.lock`.

Node version is **Unknown / Requires Confirmation**. Nothing in git sets `engines`, `.nvmrc`, or a container base image. `react-scripts` 4.0.0 is the build tool that was current with this scaffold; its Node requirement is a property of that package, not a line in this repo.

## React application

`public/index.html` is the CRA template. `%PUBLIC_URL%` is used for the favicon, apple touch icon, and manifest. The document title is `React App`. A `<noscript>` line says JavaScript is required. The mount node is `<div id="root">`.

`src/index.js`:

- Imports `index.css`, `App`, and `reportWebVitals`.
- Renders `<React.StrictMode><App /></React.StrictMode>` with `ReactDOM.render` (React 17 API, not `createRoot`).
- Calls `reportWebVitals()` with no argument.

`src/App.js` is a function component. It imports `logo.svg` and `App.css`. The external link uses `target="_blank"` and `rel="noopener noreferrer"`.

`src/App.css` centres the page, sets the header to `#282c34`, and spins `.App-logo` over 20s unless `prefers-reduced-motion: no-preference` is absent (the animation is inside that media query).

`eslintConfig` in root `package.json` extends `react-app` and `react-app/jest`.

`browserslist` in root `package.json`:

- production: `>0.2%`, `not dead`, `not op_mini all`
- development: last one version of Chrome, Firefox, and Safari

No router, no state library, no CSS framework in use. Material UI is installed and unused.

## Upload server

`server/server.js` (18 lines):

```text
express()
cors({ origin: "*", optionsSuccessStatus: 200 })
post("/upload", upload)
listen(8000, log "Server started!")
```

`server/upload.js` exports `function upload(req, res)`:

- `const IncomingForm = require("formidable").IncomingForm`
- `var form = new IncomingForm()`
- `form.on("file", ...)` empty body
- `form.on("end", () => { res.json(); })`
- `form.parse(req)`

`server/package.json`:

- `name` `server`, `version` `1.0.0`, `license` `ISC`
- `description` and `author` are empty strings
- `main` is `index.js` (file not in git)
- `scripts.test` is `echo "Error: no test specified" && exit 1`
- no `start` script

The process does not read environment variables. The port `8000` is a literal.

Express is not given `express.json()` or `express.urlencoded()`. The upload path relies on Formidable to read the stream. **Implemented.**

## APIs

| Method | Path | Process | Request | Response in source |
|---|---|---|---|---|
| POST | `/upload` | Express on port 8000 | Parsed by Formidable. Field name not set in code | `res.json()` with no argument, on form `end` |

No other application route is registered. CRA's dev server routes are supplied by `react-scripts` and are not listed in this repository.

The React package does not call this API.

## Data and storage

No database, migration, or object-store client.

Formidable receives the upload. The handler does not move the temp file and does not record a name. Where Formidable places a temp file is that library's default, which this repo does not override (`uploadDir` is unset).

`.gitignore` ignores `node_modules/` and `dist/`. It does not name CRA's `build/` directory. **Implemented** as the absence of that pattern.

## Auth and access

No authentication library and no user table.

CORS `origin: "*"` is the only access control in the server, and it permits every origin. **Implemented.**

## Background work

No queue, cron, worker, or scheduled script. `sonarqube_scan.bat` is not in git.

`reportWebVitals` is a browser callback hook and is not started.

## Security notes visible from the tree

- `POST /upload` has no auth check. **Implemented.**
- CORS allows every origin. **Implemented.**
- The handler does not restrict type or size in application code. **Implemented.**
- No password, token, or cloud key is stored in the files that were read.
- `public/robots.txt` does not disallow any path.

## Development and test

Documented commands in `README.md`:

| Text in the README | Package it matches |
|---|---|
| `npm ci` | Root React package. No `package-lock.json` is committed there, so this command has no lockfile at that path |
| `yarn start` | Root `yarn.lock` and script `start` |
| `/server` | Directory name |
| `node server.js` | `server/server.js`, run from that directory (the README does not spell the `cd`) |

Scripts the README does not mention:

| Script | Command |
|---|---|
| Root `build` | `react-scripts build` |
| Root `test` | `react-scripts test` |
| Root `eject` | `react-scripts eject` |
| Server `test` | echo error and exit 1 |

The only test file is `src/App.test.js`. It uses React Testing Library `render` and `screen.getByText(/learn react/i)`.

No coverage gate, no CI config, no editor config, no Docker Compose.

## Deployment and monitoring

No deploy script, host name, process manager, or Dockerfile.

Runtime logging that exists: `console.log("Server started!")` after bind. No access log and no error log middleware.

`public/manifest.json` is a PWA manifest for the CRA sample (`start_url` `.`, `theme_color` `#000000`, `background_color` `#ffffff`). The React code does not register a service worker. CRA's default service-worker file is not in `src/`.

## Git

Remote inspected: `git@bitbucket.org:overdrive/interview-code.git`, branch `master`, tip `cc4eee7ab27d4de5c6ea65fd95d7a618bd1bff00`.

Author of all six commits: Jaco Brits, `jaco@overdrive.co.za`, all on 2020-10-29.

The initial commit (`537b441`) contains only `.gitignore`. Its author date is `2020-10-29 06:39:06 +0000`. Later commits on the same day use `+0200`.